Don't ignore too long lines in nss_files (BZ #17079)

(cherry picked from commit ac60763eac3d43b7234dd21286ad3ec3f17957fc)

Conflicts:
	ChangeLog
	NEWS

diff --git a/ChangeLog b/ChangeLog
index 6aff2a266bbb0cd44612715a8a78f1f85ed11ae5..815acf08ddcbfe7ac32fa9cad4167ef802253a72 100644 (file)
--- a/ChangeLog
+++ b/ChangeLog
@@ -1,3 +1,9 @@
+2014-06-23  Andreas Schwab  <schwab@suse.de>
+
+       [BZ #17079]
+       * nss/nss_files/files-XXX.c (get_contents): Store overflow marker
+       before reading the next line.
+
 2015-10-02  Andreas Schwab  <schwab@suse.de>
 
        * sysdeps/posix/getaddrinfo.c (gaih_inet): Advance address pointer

diff --git a/NEWS b/NEWS
index fb0fa3cd47b39d810467bfd8ddf8ce2ca5214227..ed33f477508edcb03b5d4e279be61beeeb6bfd4e 100644 (file)
--- a/NEWS
+++ b/NEWS
@@ -10,8 +10,8 @@ Version 2.19.1
 * The following bugs are resolved with this release:
 
   15946, 16545, 16574, 16623, 16657, 16695, 16743, 16878, 16882, 16885,
-  16916, 16932, 16943, 16958, 17048, 17069, 17137, 17153, 17213, 17263,
-  17325, 17555, 18287.
+  16916, 16932, 16943, 16958, 17048, 17069, 17079, 17137, 17153, 17213,
+  17263, 17325, 17555, 18287.
 
 * A buffer overflow in gethostbyname_r and related functions performing DNS
   requests has been fixed.  If the NSS functions were called with a

diff --git a/nss/nss_files/files-XXX.c b/nss/nss_files/files-XXX.c
index 36242f9d44aa382c995af0876eeac05c61a2b040..d4cd95e26cd7113566c89b0bdfcb8e14e3364e48 100644 (file)
--- a/nss/nss_files/files-XXX.c
+++ b/nss/nss_files/files-XXX.c
@@ -198,10 +198,12 @@ get_contents (char *linebuf, size_t len, FILE *stream)
     {
       int curlen = ((remaining_len > (size_t) INT_MAX) ? INT_MAX
                    : remaining_len);
-      char *p = fgets_unlocked (curbuf, curlen, stream);
 
+      /* Terminate the line so that we can test for overflow.  */
       ((unsigned char *) curbuf)[curlen - 1] = 0xff;
 
+      char *p = fgets_unlocked (curbuf, curlen, stream);
+
       /* EOF or read error.  */
       if (p == NULL)
         return gcr_error;